Analysis
- max time kernel
96s - max time network
99s - platform
windows10_x64 - resource
win10v20210408 - submitted
29/09/2021, 10:17
Static task
static1
Behavioral task
behavioral1
Sample
3c76e12084f57410323212b79c24a4ad.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3c76e12084f57410323212b79c24a4ad.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 3c76e12084f57410323212b79c24a4ad.exe
- Size 7.2MB
- Sample210929-mbcs1sefgn
- SHA256 42e369c8a08e42bb7ca81f3b4598b1352766fd602c32adc21cd5f1afab85f7f3
- MD5 3c76e12084f57410323212b79c24a4ad
- SHA1 c2663a2189440deae7a3826109bceacaea3a99d9
- SHA512 e0cfc3ac8407426902e08851db8fa3e75142de3d927ed091e12c4603a896c581a182b9069d04ce4032f974064e66db9a68a83d48ed1982934f6203a7b08964dd
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
- Executes dropped EXE 1 IoCs
pid Process 500 disksyncer.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\netoptimize.lnk disksyncer.exe - Loads dropped DLL 13 IoCs
pid Process 656 3c76e12084f57410323212b79c24a4ad.exe 656 3c76e12084f57410323212b79c24a4ad.exe 1652 MsiExec.exe 1652 MsiExec.exe 2760 MsiExec.exe 2760 MsiExec.exe 2760 MsiExec.exe 2760 MsiExec.exe 2760 MsiExec.exe 2760 MsiExec.exe 656 3c76e12084f57410323212b79c24a4ad.exe 500 disksyncer.exe 500 disksyncer.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\N: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\Y: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\M: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\W: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\P: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\T: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\U: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\V: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\L: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\Q: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\Z: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\J: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\K: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\R: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI8336.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8441.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI85BA.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{00CE1E75-E04C-4F83-824D-20B2297C955F} msiexec.exe File created C:\Windows\Installer\17f8b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI824A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI83B4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI84FE.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI8D8B.tmp msiexec.exe File opened for modification C:\Windows\Installer\17f8b.msi msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 3c76e12084f57410323212b79c24a4ad.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 3c76e12084f57410323212b79c24a4ad.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 3c76e12084f57410323212b79c24a4ad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 3c76e12084f57410323212b79c24a4ad.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1200 msiexec.exe 1200 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 1200 msiexec.exe Token: SeCreateTokenPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeAssignPrimaryTokenPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeLockMemoryPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeIncreaseQuotaPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeMachineAccountPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeTcbPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeSecurityPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeTakeOwnershipPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeLoadDriverPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeSystemProfilePrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeSystemtimePrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeProfSingleProcessPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeIncBasePriorityPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeCreatePagefilePrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeCreatePermanentPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeBackupPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeRestorePrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeShutdownPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeDebugPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeAuditPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeSystemEnvironmentPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeChangeNotifyPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeRemoteShutdownPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeUndockPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeSyncAgentPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeEnableDelegationPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeManageVolumePrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeImpersonatePrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeCreateGlobalPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeCreateTokenPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeAssignPrimaryTokenPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeLockMemoryPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeIncreaseQuotaPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeMachineAccountPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeTcbPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeSecurityPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeTakeOwnershipPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeLoadDriverPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeSystemProfilePrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeSystemtimePrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeProfSingleProcessPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeIncBasePriorityPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeCreatePagefilePrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeCreatePermanentPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeBackupPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeRestorePrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeShutdownPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeDebugPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeAuditPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeSystemEnvironmentPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeChangeNotifyPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeRemoteShutdownPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeUndockPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeSyncAgentPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeEnableDelegationPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeManageVolumePrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeImpersonatePrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeCreateGlobalPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeCreateTokenPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeAssignPrimaryTokenPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeLockMemoryPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeIncreaseQuotaPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe Token: SeMachineAccountPrivilege 656 3c76e12084f57410323212b79c24a4ad.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2188 msiexec.exe 2188 msiexec.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1200 wrote to memory of 1652 1200 msiexec.exe 70 PID 1200 wrote to memory of 1652 1200 msiexec.exe 70 PID 1200 wrote to memory of 1652 1200 msiexec.exe 70 PID 656 wrote to memory of 2188 656 3c76e12084f57410323212b79c24a4ad.exe 71 PID 656 wrote to memory of 2188 656 3c76e12084f57410323212b79c24a4ad.exe 71 PID 656 wrote to memory of 2188 656 3c76e12084f57410323212b79c24a4ad.exe 71 PID 1200 wrote to memory of 2760 1200 msiexec.exe 72 PID 1200 wrote to memory of 2760 1200 msiexec.exe 72 PID 1200 wrote to memory of 2760 1200 msiexec.exe 72 PID 1200 wrote to memory of 500 1200 msiexec.exe 73 PID 1200 wrote to memory of 500 1200 msiexec.exe 73 PID 1200 wrote to memory of 500 1200 msiexec.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c76e12084f57410323212b79c24a4ad.exe"C:\Users\Admin\AppData\Local\Temp\3c76e12084f57410323212b79c24a4ad.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management 1.7.3.2\install\97C955F\adv.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\3c76e12084f57410323212b79c24a4ad.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1632917739 " AI_EUIMSI=""2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:2188
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 05D17D7552C707C8EEDFBEB529122C77 C2⤵
- Loads dropped DLL
PID:1652
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AF9043600EAAEC02D6208CCCCBCD42932⤵
- Loads dropped DLL
PID:2760
-
-
C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management\disksyncer.exe"C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management\disksyncer.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
PID:500
-